@quereus/quereus 4.10.0 → 4.12.0

package/dist/src/runtime/emit/create-table.js

@@ -1,6 +1,7 @@
 import { asRun } from '../types.js';
 import { createMaintainedTable } from './materialized-view-helpers.js';
 import { assertDdlTransactionPolicy } from './ddl-transaction-policy.js';
+import { withStatementScopedSchemaEvents } from './ddl-event-scope.js';
 export function emitCreateTable(plan, _ctx) {
     async function run(rctx) {
         // Strict-policy gate (see ddl-transaction-policy.ts). The owning module is the
@@ -14,16 +15,25 @@ export function emitCreateTable(plan, _ctx) {
         }
         // Ensure we're in a transaction before DDL (lazy/JIT transaction start)
         await rctx.db._ensureTransaction();
-        if (plan.statementAst.maintained) {
-            // `create table … maintained as <body>` — the declared-shape maintained
-            // form: shape-verify against the body BEFORE registration, then create +
-            // attach-to-empty through the shared attach core (all-or-nothing).
-            await createMaintainedTable(rctx.db, plan.statementAst);
-            return null;
-        }
-        await rctx.db.schemaManager.createTable(plan.statementAst);
-        // The specific error handling for IF NOT EXISTS is within SchemaManager.defineTable.
-        return null; // Explicitly return null for successful void operations
+        // Both arms run under the statement-scoped schema-event scope (see
+        // ddl-event-scope.ts). The maintained arm creates the backing table — announced —
+        // and fills it afterwards, so a fill that violates a declared constraint would
+        // otherwise announce a create and a drop for a statement that did nothing. The
+        // plain arm can fail after `module.create` too (the FK-collation check in
+        // SchemaManager.createTable), by which point an emitter-backed module has already
+        // announced.
+        return withStatementScopedSchemaEvents(rctx, async () => {
+            if (plan.statementAst.maintained) {
+                // `create table … maintained as <body>` — the declared-shape maintained
+                // form: shape-verify against the body BEFORE registration, then create +
+                // attach-to-empty through the shared attach core (all-or-nothing).
+                await createMaintainedTable(rctx.db, plan.statementAst);
+                return null;
+            }
+            await rctx.db.schemaManager.createTable(plan.statementAst);
+            // The specific error handling for IF NOT EXISTS is within SchemaManager.defineTable.
+            return null; // Explicitly return null for successful void operations
+        });
     }
     return { params: [], run: asRun(run), note: `createTable(${plan.statementAst.table.name})` };
 }

package/dist/src/runtime/emit/create-table.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-table.js","sourceRoot":"","sources":["../../../../src/runtime/emit/create-table.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAGpC,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAEzE,MAAM,UAAU,eAAe,CAAC,IAAqB,EAAE,IAAqB;IAC3E,KAAK,UAAU,GAAG,CAAC,IAAoB;QACtC,+EAA+E;QAC/E,yEAAyE;QACzE,gFAAgF;QAChF,4BAA4B;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,IAAI,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,wBAAwB,EAAE,CAAC;QACpG,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC;YACvB,0BAA0B,CACzB,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,EAAE,UAAU,EACrC,gBAAgB,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,CAC9C,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,MAAM,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,CAAC;QAEnC,IAAI,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;YAClC,wEAAwE;YACxE,yEAAyE;YACzE,mEAAmE;YACnE,MAAM,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3D,qFAAqF;QAErF,OAAO,IAAI,CAAC,CAAC,wDAAwD;IACtE,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC;AAC9F,CAAC"}
+{"version":3,"file":"create-table.js","sourceRoot":"","sources":["../../../../src/runtime/emit/create-table.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAGpC,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC;AAEvE,MAAM,UAAU,eAAe,CAAC,IAAqB,EAAE,IAAqB;IAC3E,KAAK,UAAU,GAAG,CAAC,IAAoB;QACtC,+EAA+E;QAC/E,yEAAyE;QACzE,gFAAgF;QAChF,4BAA4B;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,IAAI,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,wBAAwB,EAAE,CAAC;QACpG,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC;YACvB,0BAA0B,CACzB,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,EAAE,UAAU,EACrC,gBAAgB,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,CAC9C,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,MAAM,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,CAAC;QAEnC,mEAAmE;QACnE,kFAAkF;QAClF,+EAA+E;QAC/E,+EAA+E;QAC/E,0EAA0E;QAC1E,kFAAkF;QAClF,aAAa;QACb,OAAO,+BAA+B,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;YACvD,IAAI,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;gBAClC,wEAAwE;gBACxE,yEAAyE;gBACzE,mEAAmE;gBACnE,MAAM,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;gBACxD,OAAO,IAAI,CAAC;YACb,CAAC;YAED,MAAM,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC3D,qFAAqF;YAErF,OAAO,IAAI,CAAC,CAAC,wDAAwD;QACtE,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC;AAC9F,CAAC"}

package/dist/src/runtime/emit/create-view.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-view.d.ts","sourceRoot":"","sources":["../../../../src/runtime/emit/create-view.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAkB,MAAM,aAAa,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAM9D,wBAAgB,cAAc,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,GAAG,WAAW,CAsEvF"}
+{"version":3,"file":"create-view.d.ts","sourceRoot":"","sources":["../../../../src/runtime/emit/create-view.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAkB,MAAM,aAAa,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAO9D,wBAAgB,cAAc,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,GAAG,WAAW,CA4EvF"}

package/dist/src/runtime/emit/create-view.js

@@ -1,55 +1,62 @@
 import { QuereusError } from '../../common/errors.js';
 import { StatusCode } from '../../common/types.js';
 import { assertCatalogObjectPersistable } from '../../schema/catalog-persistability.js';
+import { withStatementScopedSchemaEvents } from './ddl-event-scope.js';
 export function emitCreateView(plan, _ctx) {
     async function run(rctx) {
         // Ensure we're in a transaction before DDL (lazy/JIT transaction start)
         await rctx.db._ensureTransaction();
-        // Check if view already exists
-        const existingView = rctx.db.schemaManager.getView(plan.schemaName, plan.viewName);
-        if (existingView && !plan.ifNotExists) {
-            throw new QuereusError(`View '${plan.schemaName}.${plan.viewName}' already exists`, StatusCode.ERROR);
-        }
-        if (existingView && plan.ifNotExists) {
-            // View exists but IF NOT EXISTS was specified, so this is a no-op
-            return null;
-        }
-        // Create the view schema. Any `with defaults (…)` rides inside
-        // plan.selectStmt (→ selectAst), so there is no separate field to thread.
-        const viewSchema = {
-            name: plan.viewName,
-            schemaName: plan.schemaName,
-            sql: plan.sql,
-            selectAst: plan.selectStmt,
-            columns: plan.columns,
-            tags: plan.tags,
-        };
-        // Add the view to the schema manager
-        const schema = rctx.db.schemaManager.getSchema(plan.schemaName);
-        if (!schema) {
-            throw new QuereusError(`Schema '${plan.schemaName}' does not exist`, StatusCode.ERROR);
-        }
-        // Refuse up front if a registered module could not durably persist this
-        // definition — the persistence itself is fire-and-forget (see
-        // assertCatalogObjectPersistable), so this is the only place the failure can
-        // reach the statement. Nothing has been mutated yet, so a throw is a clean no-op.
-        assertCatalogObjectPersistable(rctx.db, 'view', viewSchema);
-        schema.addView(viewSchema);
-        // Fire view_added so a store-backed catalog can persist this view. Fired
-        // here (not from Schema.addView) so only user/declarative DDL views are
-        // persisted; internal views (lens bodies, etc.) register via schema.addView
-        // directly and are deliberately excluded. Not reached on the IF NOT EXISTS
-        // no-op above.
-        rctx.db.schemaManager.getChangeNotifier().notifyChange({
-            type: 'view_added',
-            // Stored names of the registered ViewSchema — see
-            // SchemaManager.canonicalSchemaName for the emitter/stored-name invariant
-            // (plan.schemaName is already canonical via the builder, so they coincide).
-            schemaName: viewSchema.schemaName,
-            objectName: viewSchema.name,
-            newObject: viewSchema,
+        // Statement-scoped schema-event scope. This statement raises nothing on the public
+        // schema channel today (`view_added` is an internal catalog notification), so the
+        // scope is a no-op — it is here so the invariant holds by construction: see
+        // ddl-event-scope.ts.
+        return withStatementScopedSchemaEvents(rctx, async () => {
+            // Check if view already exists
+            const existingView = rctx.db.schemaManager.getView(plan.schemaName, plan.viewName);
+            if (existingView && !plan.ifNotExists) {
+                throw new QuereusError(`View '${plan.schemaName}.${plan.viewName}' already exists`, StatusCode.ERROR);
+            }
+            if (existingView && plan.ifNotExists) {
+                // View exists but IF NOT EXISTS was specified, so this is a no-op
+                return null;
+            }
+            // Create the view schema. Any `with defaults (…)` rides inside
+            // plan.selectStmt (→ selectAst), so there is no separate field to thread.
+            const viewSchema = {
+                name: plan.viewName,
+                schemaName: plan.schemaName,
+                sql: plan.sql,
+                selectAst: plan.selectStmt,
+                columns: plan.columns,
+                tags: plan.tags,
+            };
+            // Add the view to the schema manager
+            const schema = rctx.db.schemaManager.getSchema(plan.schemaName);
+            if (!schema) {
+                throw new QuereusError(`Schema '${plan.schemaName}' does not exist`, StatusCode.ERROR);
+            }
+            // Refuse up front if a registered module could not durably persist this
+            // definition — the persistence itself is fire-and-forget (see
+            // assertCatalogObjectPersistable), so this is the only place the failure can
+            // reach the statement. Nothing has been mutated yet, so a throw is a clean no-op.
+            assertCatalogObjectPersistable(rctx.db, 'view', viewSchema);
+            schema.addView(viewSchema);
+            // Fire view_added so a store-backed catalog can persist this view. Fired
+            // here (not from Schema.addView) so only user/declarative DDL views are
+            // persisted; internal views (lens bodies, etc.) register via schema.addView
+            // directly and are deliberately excluded. Not reached on the IF NOT EXISTS
+            // no-op above.
+            rctx.db.schemaManager.getChangeNotifier().notifyChange({
+                type: 'view_added',
+                // Stored names of the registered ViewSchema — see
+                // SchemaManager.canonicalSchemaName for the emitter/stored-name invariant
+                // (plan.schemaName is already canonical via the builder, so they coincide).
+                schemaName: viewSchema.schemaName,
+                objectName: viewSchema.name,
+                newObject: viewSchema,
+            });
+            return null; // Explicitly return null for successful void operations
         });
-        return null; // Explicitly return null for successful void operations
     }
     return {
         params: [],

package/dist/src/runtime/emit/create-view.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-view.js","sourceRoot":"","sources":["../../../../src/runtime/emit/create-view.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAiB,MAAM,uBAAuB,CAAC;AAElE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAExF,MAAM,UAAU,cAAc,CAAC,IAAoB,EAAE,IAAqB;IACzE,KAAK,UAAU,GAAG,CAAC,IAAoB;QACtC,wEAAwE;QACxE,MAAM,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,CAAC;QAEnC,+BAA+B;QAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEnF,IAAI,YAAY,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,IAAI,YAAY,CACrB,SAAS,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,kBAAkB,EAC3D,UAAU,CAAC,KAAK,CAChB,CAAC;QACH,CAAC;QAED,IAAI,YAAY,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACtC,kEAAkE;YAClE,OAAO,IAAI,CAAC;QACb,CAAC;QAED,+DAA+D;QAC/D,0EAA0E;QAC1E,MAAM,UAAU,GAAe;YAC9B,IAAI,EAAE,IAAI,CAAC,QAAQ;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;SACf,CAAC;QAEF,qCAAqC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,YAAY,CACrB,WAAW,IAAI,CAAC,UAAU,kBAAkB,EAC5C,UAAU,CAAC,KAAK,CAChB,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,8DAA8D;QAC9D,6EAA6E;QAC7E,kFAAkF;QAClF,8BAA8B,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAE5D,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE3B,yEAAyE;QACzE,wEAAwE;QACxE,4EAA4E;QAC5E,2EAA2E;QAC3E,eAAe;QACf,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,iBAAiB,EAAE,CAAC,YAAY,CAAC;YACtD,IAAI,EAAE,YAAY;YAClB,kDAAkD;YAClD,0EAA0E;YAC1E,4EAA4E;YAC5E,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,UAAU,EAAE,UAAU,CAAC,IAAI;YAC3B,SAAS,EAAE,UAAU;SACrB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,CAAC,wDAAwD;IACtE,CAAC;IAED,OAAO;QACN,MAAM,EAAE,EAAE;QACV,GAAG;QACH,IAAI,EAAE,cAAc,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,GAAG;KACvD,CAAC;AACH,CAAC"}
+{"version":3,"file":"create-view.js","sourceRoot":"","sources":["../../../../src/runtime/emit/create-view.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAiB,MAAM,uBAAuB,CAAC;AAElE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AACxF,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC;AAEvE,MAAM,UAAU,cAAc,CAAC,IAAoB,EAAE,IAAqB;IACzE,KAAK,UAAU,GAAG,CAAC,IAAoB;QACtC,wEAAwE;QACxE,MAAM,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,CAAC;QAEnC,mFAAmF;QACnF,kFAAkF;QAClF,4EAA4E;QAC5E,sBAAsB;QACtB,OAAO,+BAA+B,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;YACvD,+BAA+B;YAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAEnF,IAAI,YAAY,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACvC,MAAM,IAAI,YAAY,CACrB,SAAS,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,kBAAkB,EAC3D,UAAU,CAAC,KAAK,CAChB,CAAC;YACH,CAAC;YAED,IAAI,YAAY,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACtC,kEAAkE;gBAClE,OAAO,IAAI,CAAC;YACb,CAAC;YAED,+DAA+D;YAC/D,0EAA0E;YAC1E,MAAM,UAAU,GAAe;gBAC9B,IAAI,EAAE,IAAI,CAAC,QAAQ;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,SAAS,EAAE,IAAI,CAAC,UAAU;gBAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,IAAI,EAAE,IAAI,CAAC,IAAI;aACf,CAAC;YAEF,qCAAqC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,IAAI,YAAY,CACrB,WAAW,IAAI,CAAC,UAAU,kBAAkB,EAC5C,UAAU,CAAC,KAAK,CAChB,CAAC;YACH,CAAC;YAED,wEAAwE;YACxE,8DAA8D;YAC9D,6EAA6E;YAC7E,kFAAkF;YAClF,8BAA8B,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YAE5D,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAE3B,yEAAyE;YACzE,wEAAwE;YACxE,4EAA4E;YAC5E,2EAA2E;YAC3E,eAAe;YACf,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,iBAAiB,EAAE,CAAC,YAAY,CAAC;gBACtD,IAAI,EAAE,YAAY;gBAClB,kDAAkD;gBAClD,0EAA0E;gBAC1E,4EAA4E;gBAC5E,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,UAAU,EAAE,UAAU,CAAC,IAAI;gBAC3B,SAAS,EAAE,UAAU;aACrB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,CAAC,wDAAwD;QACtE,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,OAAO;QACN,MAAM,EAAE,EAAE;QACV,GAAG;QACH,IAAI,EAAE,cAAc,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,GAAG;KACvD,CAAC;AACH,CAAC"}

package/dist/src/runtime/emit/ddl-event-scope.d.ts

@@ -0,0 +1,71 @@
+import type { RuntimeContext } from '../types.js';
+/**
+ * Runs one whole DDL statement with its schema events made RETRACTABLE: if `fn` throws,
+ * every schema event batched since the call is dropped before the error propagates, so a
+ * statement that unwound announces nothing at all.
+ *
+ * The other half of the "one event per statement, on the success path only" rule. The
+ * engine's own auto emits satisfy the rule by construction (they sit at the tail of the
+ * catalog mutation, past any throw), but a backend that emits for ITSELF cannot: it emits
+ * from inside `module.create` / `module.alterTable` / `module.destroy`, which is not the end
+ * of the statement. Two demonstrated leaks:
+ *
+ *  - `alter table … add column <inline constraint>` installs each constraint through further
+ *    module calls; a failure there runs `revertAddColumn` — by which point the module's
+ *    announcement, carrying the statement's SQL, already sits in the transaction's batch.
+ *  - `create table … maintained as <body>` creates the backing table (announced) and fills it
+ *    afterwards; a fill that violates a declared constraint drops the table again, so
+ *    subscribers see a create followed by a drop for a statement that did nothing. This one
+ *    leaks on the ENGINE's path too, because the drop's own auto emit is a second statement's
+ *    worth of announcement inside one failing statement.
+ *
+ * A syncing peer that re-executed either announcement would diverge from the device where the
+ * statement failed.
+ *
+ * ## The rule
+ *
+ * **Every DDL statement emitter opens this scope around its `run()` body** — including the
+ * ones that raise no schema event today (`create view`, the assertion verbs, the tag arms).
+ * The point is that the invariant holds by construction: if one of those ever starts
+ * announcing, it cannot reintroduce the class. Check it against the DDL block of
+ * `runtime/register.ts`.
+ *
+ * **The declarative statements (`apply schema` and friends) deliberately do NOT open one.**
+ * `emitApplySchema` generates migration DDL and runs each generated statement through
+ * `db._execWithinTransaction`. A failure on statement 5 leaves statements 1–4 *applied* —
+ * there is no catalog rollback, and inside an explicit transaction the user may still commit.
+ * Those four really happened and must stay announced; a scope around the whole apply would
+ * retract them. The per-statement rule gives the right answer there for free: each generated
+ * sub-statement runs its own emitter, so each opens and spends its own scope.
+ *
+ * ## Call shape
+ *
+ * Call it INSIDE the emitter's `run()` — after `assertDdlTransactionPolicy` and
+ * `await db._ensureTransaction()`, so the mark is taken with batching already on. Retraction
+ * is a no-op without a batch, which is correct: the events were delivered synchronously and
+ * nothing can call them back. Placement is not load-bearing for correctness (the watermark is
+ * a lifetime-monotonic counter), but keeping it identical everywhere makes the invariant
+ * readable.
+ *
+ * Only the SCHEMA channel is retracted — see
+ * {@link DatabaseEventEmitter.discardSchemaEventsSince} for why touching the data channel here
+ * would swallow earlier statements' committed writes.
+ *
+ * NOTE: retraction is the right answer only while a failed statement's catalog change does not
+ * OUTLIVE the failure — the same condition the `apply schema` carve-out above turns on. It
+ * holds today by placement: every engine auto emit sits at the tail of its catalog mutation
+ * (`SchemaManager.createTable` / `createIndex` / `dropIndex` / `dropTable` / `createBackingTable`),
+ * and the only post-emit work any DDL emitter still does — `dropMaintainedTable`'s
+ * `materialized_view_removed` notify — cannot throw, because `SchemaChangeNotifier.notifyChange`
+ * swallows listener errors. If a DDL emitter ever gains work that runs AFTER a catalog change
+ * landed and can throw, this scope would un-announce a change the catalog kept; that arm needs
+ * the carve-out treatment (its own inner scope, or no scope), not a wider one.
+ *
+ * NOTE: nothing nests these scopes today (`apply schema` is unwrapped, and the one ALTER arm
+ * that runs nested SQL — the ALTER PRIMARY KEY shadow rebuild — does it under
+ * `withPublicEventsSuppressed`, so it batches no events at all). If an arm ever did nest one,
+ * the outer failure would retract the inner statement's events too, which is the wanted
+ * reading: the outer statement unwound, so everything it did announces nothing.
+ */
+export declare function withStatementScopedSchemaEvents<T>(rctx: RuntimeContext, fn: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=ddl-event-scope.d.ts.map

package/dist/src/runtime/emit/ddl-event-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ddl-event-scope.d.ts","sourceRoot":"","sources":["../../../../src/runtime/emit/ddl-event-scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,wBAAsB,+BAA+B,CAAC,CAAC,EACtD,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAClB,OAAO,CAAC,CAAC,CAAC,CASZ"}

package/dist/src/runtime/emit/ddl-event-scope.js

@@ -0,0 +1,80 @@
+/**
+ * Runs one whole DDL statement with its schema events made RETRACTABLE: if `fn` throws,
+ * every schema event batched since the call is dropped before the error propagates, so a
+ * statement that unwound announces nothing at all.
+ *
+ * The other half of the "one event per statement, on the success path only" rule. The
+ * engine's own auto emits satisfy the rule by construction (they sit at the tail of the
+ * catalog mutation, past any throw), but a backend that emits for ITSELF cannot: it emits
+ * from inside `module.create` / `module.alterTable` / `module.destroy`, which is not the end
+ * of the statement. Two demonstrated leaks:
+ *
+ *  - `alter table … add column <inline constraint>` installs each constraint through further
+ *    module calls; a failure there runs `revertAddColumn` — by which point the module's
+ *    announcement, carrying the statement's SQL, already sits in the transaction's batch.
+ *  - `create table … maintained as <body>` creates the backing table (announced) and fills it
+ *    afterwards; a fill that violates a declared constraint drops the table again, so
+ *    subscribers see a create followed by a drop for a statement that did nothing. This one
+ *    leaks on the ENGINE's path too, because the drop's own auto emit is a second statement's
+ *    worth of announcement inside one failing statement.
+ *
+ * A syncing peer that re-executed either announcement would diverge from the device where the
+ * statement failed.
+ *
+ * ## The rule
+ *
+ * **Every DDL statement emitter opens this scope around its `run()` body** — including the
+ * ones that raise no schema event today (`create view`, the assertion verbs, the tag arms).
+ * The point is that the invariant holds by construction: if one of those ever starts
+ * announcing, it cannot reintroduce the class. Check it against the DDL block of
+ * `runtime/register.ts`.
+ *
+ * **The declarative statements (`apply schema` and friends) deliberately do NOT open one.**
+ * `emitApplySchema` generates migration DDL and runs each generated statement through
+ * `db._execWithinTransaction`. A failure on statement 5 leaves statements 1–4 *applied* —
+ * there is no catalog rollback, and inside an explicit transaction the user may still commit.
+ * Those four really happened and must stay announced; a scope around the whole apply would
+ * retract them. The per-statement rule gives the right answer there for free: each generated
+ * sub-statement runs its own emitter, so each opens and spends its own scope.
+ *
+ * ## Call shape
+ *
+ * Call it INSIDE the emitter's `run()` — after `assertDdlTransactionPolicy` and
+ * `await db._ensureTransaction()`, so the mark is taken with batching already on. Retraction
+ * is a no-op without a batch, which is correct: the events were delivered synchronously and
+ * nothing can call them back. Placement is not load-bearing for correctness (the watermark is
+ * a lifetime-monotonic counter), but keeping it identical everywhere makes the invariant
+ * readable.
+ *
+ * Only the SCHEMA channel is retracted — see
+ * {@link DatabaseEventEmitter.discardSchemaEventsSince} for why touching the data channel here
+ * would swallow earlier statements' committed writes.
+ *
+ * NOTE: retraction is the right answer only while a failed statement's catalog change does not
+ * OUTLIVE the failure — the same condition the `apply schema` carve-out above turns on. It
+ * holds today by placement: every engine auto emit sits at the tail of its catalog mutation
+ * (`SchemaManager.createTable` / `createIndex` / `dropIndex` / `dropTable` / `createBackingTable`),
+ * and the only post-emit work any DDL emitter still does — `dropMaintainedTable`'s
+ * `materialized_view_removed` notify — cannot throw, because `SchemaChangeNotifier.notifyChange`
+ * swallows listener errors. If a DDL emitter ever gains work that runs AFTER a catalog change
+ * landed and can throw, this scope would un-announce a change the catalog kept; that arm needs
+ * the carve-out treatment (its own inner scope, or no scope), not a wider one.
+ *
+ * NOTE: nothing nests these scopes today (`apply schema` is unwrapped, and the one ALTER arm
+ * that runs nested SQL — the ALTER PRIMARY KEY shadow rebuild — does it under
+ * `withPublicEventsSuppressed`, so it batches no events at all). If an arm ever did nest one,
+ * the outer failure would retract the inner statement's events too, which is the wanted
+ * reading: the outer statement unwound, so everything it did announces nothing.
+ */
+export async function withStatementScopedSchemaEvents(rctx, fn) {
+    const emitter = rctx.db._getEventEmitter();
+    const watermark = emitter.beginSchemaEventScope();
+    try {
+        return await fn();
+    }
+    catch (err) {
+        emitter.discardSchemaEventsSince(watermark);
+        throw err;
+    }
+}
+//# sourceMappingURL=ddl-event-scope.js.map

package/dist/src/runtime/emit/ddl-event-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ddl-event-scope.js","sourceRoot":"","sources":["../../../../src/runtime/emit/ddl-event-scope.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACpD,IAAoB,EACpB,EAAoB;IAEpB,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAClD,IAAI,CAAC;QACJ,OAAO,MAAM,EAAE,EAAE,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,GAAG,CAAC;IACX,CAAC;AACF,CAAC"}

package/dist/src/runtime/emit/dml-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dml-executor.d.ts","sourceRoot":"","sources":["../../../../src/runtime/emit/dml-executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAA+C,MAAM,aAAa,CAAC;AAO5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAI9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAiTzD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,CAQ7E;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,eAAe,GAAG,WAAW,CAywCxF"}
+{"version":3,"file":"dml-executor.d.ts","sourceRoot":"","sources":["../../../../src/runtime/emit/dml-executor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAA+C,MAAM,aAAa,CAAC;AAO5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAI9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAgTzD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,CAQ7E;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,eAAe,GAAG,WAAW,CAixCxF"}

package/dist/src/runtime/emit/dml-executor.js

@@ -10,7 +10,7 @@ import { isMaintainedTable } from '../../schema/derivation.js';
 import { hasNativeEventSupport } from '../../util/event-support.js';
 import { sqlValueIdentical, compareSqlValuesFast, BINARY_COLLATION } from '../../util/comparison.js';
 import { uniqueEnforcementComparators } from '../../schema/unique-enforcement.js';
-import { validateAndParse } from '../../types/validation.js';
+import { buildCellCoercion } from '../../types/validation.js';
 import { withAsyncRowContext } from '../context-helpers.js';
 import { REPR_STRICT } from '../strict-flags.js';
 import { assertRowConforms } from '../strict-representation.js';
@@ -279,7 +279,11 @@ export function emitDmlExecutor(plan, ctx) {
         for (const attr of plan.contextAttributes) {
             const valueNode = plan.mutationContextValues.get(attr.name);
             if (!valueNode) {
-                throw new QuereusError(`Missing mutation context value for '${attr.name}'`, StatusCode.INTERNAL);
+                // Invariant, not user input: the DML builders fill EVERY declared context
+                // slot — the supplied value expression, or a NULL literal when the statement
+                // omitted the variable (planner/building/mutation-context.ts). A gap here
+                // would silently shift the evaluated context row against contextDescriptor.
+                throw new QuereusError(`Internal: no mutation context evaluator for '${attr.name}'`, StatusCode.INTERNAL);
             }
             const instruction = emitCallFromPlan(valueNode, ctx);
             contextEvaluatorInstructions.push(instruction);
@@ -326,12 +330,14 @@ export function emitDmlExecutor(plan, ctx) {
                     else {
                         runtime.assignmentIndices.set(colIndex, evaluatorIndex);
                     }
-                    // Same static-type rule as emitUpdate: convert only when the
-                    // assignment expression's type is not the column's declared type.
-                    // Applies to a generated value too — it is written to the same cell.
+                    // Same decision as emitUpdate, from the same helper: convert unless the
+                    // assignment expression's type IS the column's declared type AND the
+                    // value already inhabits it. Applies to a generated value too — it is
+                    // written to the same cell.
                     const column = tableSchema.columns[colIndex];
-                    if (valueNode.getType().logicalType !== column.logicalType) {
-                        runtime.assignmentCoercions.set(colIndex, column);
+                    const coerce = buildCellCoercion(valueNode.getType().logicalType, column.logicalType, column.name);
+                    if (coerce) {
+                        runtime.assignmentCoercions.set(colIndex, coerce);
                     }
                 }
                 // Keep topological order (drive off the plan's list, not map order).
@@ -377,11 +383,9 @@ export function emitDmlExecutor(plan, ctx) {
             notNullDefaults: upsertValidation.notNullDefaults.map((d, i) => ({
                 columnIndex: d.columnIndex,
                 evaluatorIndex: defaultStart + i,
-                // Same static-type rule as everywhere else a DEFAULT is substituted after
-                // the emitters' conversion pass — see NotNullDefaultRuntime.coerceColumn.
-                coerceColumn: d.defaultNode.getType().logicalType !== tableSchema.columns[d.columnIndex].logicalType
-                    ? tableSchema.columns[d.columnIndex]
-                    : undefined,
+                // Same decision as everywhere else a DEFAULT is substituted after the
+                // emitters' conversion pass — see NotNullDefaultRuntime.coerce.
+                coerce: buildCellCoercion(d.defaultNode.getType().logicalType, tableSchema.columns[d.columnIndex].logicalType, tableSchema.columns[d.columnIndex].name),
             })),
             flatDescriptor: upsertValidation.flatRowDescriptor,
             combinedDescriptor: plan.contextDescriptor
@@ -461,7 +465,7 @@ export function emitDmlExecutor(plan, ctx) {
         const notNullDefaults = validation.notNullDefaults.map(d => ({
             columnIndex: d.columnIndex,
             evaluator: upsertEvaluators[d.evaluatorIndex],
-            coerceColumn: d.coerceColumn,
+            coerce: d.coerce,
         }));
         const useContext = contextRow !== undefined && validation.combinedDescriptor !== undefined;
         const descriptor = useContext ? validation.combinedDescriptor : validation.flatDescriptor;
@@ -514,12 +518,12 @@ export function emitDmlExecutor(plan, ctx) {
                         return await evaluator(rctx);
                     });
                 });
-                // Convert to the declared column type when the assignment's static
-                // type requires it (see assignmentCoercions) — `existingRow` is a
-                // stored row, so the composed updatedRow is then fully declared-form.
-                const coerceColumn = clause.assignmentCoercions?.get(colIndex);
-                if (coerceColumn) {
-                    value = validateAndParse(value, coerceColumn.logicalType, coerceColumn.name);
+                // Convert to the declared column type as the assignment requires (see
+                // assignmentCoercions) — `existingRow` is a stored row, so the composed
+                // updatedRow is then fully declared-form.
+                const coerce = clause.assignmentCoercions?.get(colIndex);
+                if (coerce) {
+                    value = coerce(value);
                 }
                 updatedRow[colIndex] = value;
             }
@@ -547,9 +551,9 @@ export function emitDmlExecutor(plan, ctx) {
             await withAsyncRowContext(rctx, clause.generatedRowDescriptor, () => updatedRow, async () => {
                 for (const { colIndex, evaluatorIndex } of clause.generatedAssignments) {
                     let value = await upsertEvaluators[evaluatorIndex](rctx);
-                    const coerceColumn = clause.assignmentCoercions?.get(colIndex);
-                    if (coerceColumn) {
-                        value = validateAndParse(value, coerceColumn.logicalType, coerceColumn.name);
+                    const coerce = clause.assignmentCoercions?.get(colIndex);
+                    if (coerce) {
+                        value = coerce(value);
                     }
                     updatedRow[colIndex] = value;
                 }
@@ -1033,7 +1037,7 @@ export function emitDmlExecutor(plan, ctx) {
         // replaced by key accumulation + one chunked probe per FK at the
         // end-of-statement boundary. The plan side made the same gate decision
         // and skipped the per-row NOT EXISTS checks.
-        const batchableFks = getBatchableRestrictFks(ctx.db.schemaManager, tableSchema, 'update', plan.onConflict, plan.lensRouted);
+        const batchableFks = getBatchableRestrictFks(ctx.db, tableSchema, 'update', plan.onConflict, plan.lensRouted);
         const fkRestrictBatch = batchableFks ? createParentRestrictBatch(batchableFks) : undefined;
         // Physical Halloween avoidance: unless the target module guarantees per-scan
         // snapshot isolation, fully drain the source match set (closing the scan
@@ -1170,7 +1174,7 @@ export function emitDmlExecutor(plan, ctx) {
         // Batched parent-side RESTRICT enforcement — see the matching note in
         // runUpdate (per-execution state; one chunked probe per FK at the
         // end-of-statement boundary when the gate admits the statement).
-        const batchableFks = getBatchableRestrictFks(ctx.db.schemaManager, tableSchema, 'delete', plan.onConflict, plan.lensRouted);
+        const batchableFks = getBatchableRestrictFks(ctx.db, tableSchema, 'delete', plan.onConflict, plan.lensRouted);
         const fkRestrictBatch = batchableFks ? createParentRestrictBatch(batchableFks) : undefined;
         // Physical Halloween avoidance — see the matching note in runUpdate. Unless
         // the target module guarantees per-scan snapshot isolation, drain the source